Leaderboard github.com

Eugeny/tabby

A terminal for a more modern age

View repository ↗
TypeScript
★ 75,433
commit 467ce8ebfa46
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

59/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

47/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% explicit

Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.

How the score is built

Explicitly attributed share1%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share1%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.02

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	7	181	2026-04-21	2026-10-06
GitHub Copilot coding agent	6	167	2025-10-20	2026-09-12
Cursor agent	1	18	2026-09-11	2026-09-11

Lines added per month all AI-attributed share

2016-121,745 · 0% AI
2017-01156 · 0% AI
2017-032,271 · 0% AI
2017-042,489 · 0% AI
2017-053,757 · 0% AI
2017-06705 · 0% AI
2017-071,530 · 0% AI
2017-08188 · 0% AI
2017-09164 · 0% AI
2017-10218 · 0% AI
2017-11777 · 0% AI
2017-12161 · 0% AI
2018-01121 · 0% AI
2018-0213 · 0% AI
2018-03350 · 0% AI
2018-0488 · 0% AI
2018-05231 · 0% AI
2018-060 · 0% AI
2018-0710 · 0% AI
2018-082,469 · 0% AI
2018-09785 · 0% AI
2018-10857 · 0% AI
2018-11172 · 0% AI
2018-12920 · 0% AI
2019-01729 · 0% AI
2019-02266 · 0% AI
2019-031,606 · 0% AI
2019-0476 · 0% AI
2019-05434 · 0% AI
2019-062,028 · 0% AI
2019-07630 · 0% AI
2019-08111 · 0% AI
2019-09186 · 0% AI
2019-1043 · 0% AI
2019-1162 · 0% AI
2019-12789 · 0% AI
2020-01408 · 0% AI
2020-021,535 · 0% AI
2020-031,259 · 0% AI
2020-04313 · 0% AI
2020-0567 · 0% AI
2020-0649 · 0% AI
2020-07105 · 0% AI
2020-08212 · 0% AI
2020-090 · 0% AI
2020-1053 · 0% AI
2020-1146 · 0% AI
2020-12755 · 0% AI
2021-01910 · 0% AI
2021-02305 · 0% AI
2021-03318 · 0% AI
2021-04893 · 0% AI
2021-052,174 · 0% AI
2021-064,876 · 0% AI
2021-076,674 · 0% AI
2021-081,368 · 0% AI
2021-09590 · 0% AI
2021-10269 · 0% AI
2021-11235 · 0% AI
2021-121,103 · 0% AI
2022-011,402 · 0% AI
2022-02771 · 0% AI
2022-03222 · 0% AI
2022-04364 · 0% AI
2022-05481 · 0% AI
2022-06109 · 0% AI
2022-07107 · 0% AI
2022-0821 · 0% AI
2022-09166 · 0% AI
2022-10214 · 0% AI
2022-11571 · 0% AI
2022-12326 · 0% AI
2023-01194 · 0% AI
2023-02898 · 0% AI
2023-03458 · 0% AI
2023-04439 · 0% AI
2023-05214 · 0% AI
2023-06257 · 0% AI
2023-071,007 · 0% AI
2023-08630 · 0% AI
2023-0963 · 0% AI
2023-1049 · 0% AI
2023-1146 · 0% AI
2023-1230 · 0% AI
2024-01115 · 0% AI
2024-029 · 0% AI
2024-0349 · 0% AI
2024-040 · 0% AI
2024-051 · 0% AI
2024-063 · 0% AI
2024-07112 · 0% AI
2024-08418 · 0% AI
2024-096 · 0% AI
2024-10615 · 0% AI
2024-11277 · 0% AI
2024-1268 · 0% AI
2025-01300 · 0% AI
2025-0255 · 0% AI
2025-0337 · 0% AI
2025-040 · 0% AI
2025-0543 · 0% AI
2025-06132 · 0% AI
2025-07302 · 0% AI
2025-081 · 0% AI
2025-092 · 0% AI
2025-1091 · 18% AI
2025-11103 · 0% AI
2025-1221 · 0% AI
2026-01345 · 16% AI
2026-02298 · 0% AI
2026-030 · 0% AI
2026-04219 · 50% AI
2026-05761 · 0% AI
2026-061,245 · 0% AI
2026-07385 · 0% AI
2026-091,561 · 10% AI
2026-10394 · 7% AI

Findings in AI-attributed lines vs the rest

From git blame: 343 lines trace to AI-attributed commits, 31,875 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	0.00	3.64	—
Security	5.83	3.14	—

Evidence by analyzer

Explicit AI attributionok17 items

Claude Code: 7 attributed commits, 181 lines added
GitHub Copilot coding agent: 6 attributed commits, 167 lines added
Cursor agent: 1 attributed commits, 18 lines added
Claude Code: trailer 'Co-authored-by: Claude'
Claude Code: trailer 'Co-authored-by: Claude'
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
Claude Code: trailer 'Co-authored-by: Claude'
Claude Code: trailer 'Co-authored-by: Claude'
Cursor agent: trailer 'Co-authored-by: Cursor Agent'
Claude Code: trailer 'Co-authored-by: Claude'
GitHub Copilot coding agent: author Copilot
GitHub Copilot coding agent: trailer 'Co-authored-by: copilot'
Claude Code: trailer 'Co-authored-by: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'

attributed_commit_share: 0.3%
attributed_commits: 14
attributed_loc: 366
attributed_loc_share: 0.5%
commits: 5,037
effective_loc: 68,661
tools_detected: 3

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 0
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 861
measured_loc: 68,661
median_loc_per_hour: 49.14
pr_timed_units: 148
pre_ai_era_burst_loc: 3,444
pre_ai_era_bursts: 1
pre_ai_era_measured_loc: 41,058
work_units: 1,342

Release velocityok

flagged_releases: 0
max_loc_per_day: 492.20
releases: 99

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 1
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 0
files:placeholder: 0
index: 0.02
lines_scanned: 32,218
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.03
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 343
blame_failures: 0
files_blamed: 331
other_lines: 31,875
quality:ai_findings: 0
quality:ai_per_kloc: 0
quality:other_findings: 116
quality:other_per_kloc: 3.64
security:ai_findings: 2
security:ai_per_kloc: 5.83
security:other_findings: 100
security:other_per_kloc: 3.14

Code quality

59 weak

Code quality is weak: test-to-source ratio 0.01, no CI test run detected; 10% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety.

How the score is built

Complexity75
Duplication84
Lint and smells64
Tests and CI37
Documentation65
Type safety0
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 46
function_nloc: 22,298
functions: 4,308
long_functions: 4
many_param_functions: 6
mean_ccn: 2.27
p90_ccn: 4
risky_nloc_share: 9.7%

Duplication (jscpd)ok10 items

compared_lines: 20,773
duplicated_lines: 599
duplicated_share: 2.9%
files: 331

Lintok

category:best-practice: 28
category:correctness: 88
findings: 116
scanned_lines: 32,213
weighted_findings: 57.50

Tests and CIok4 items

CI config: .github/workflows/build.yml .github/workflows/build.yml
CI config: .github/workflows/codeql-analysis.yml .github/workflows/codeql-analysis.yml
CI config: .github/workflows/docs.yml .github/workflows/docs.yml
CI config: .github/workflows/release.yml .github/workflows/release.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: no
ci_files: 4
cochange_commits: 194
cochange_share: 4.6%
source_lines: 32,218
test_lines: 379
test_ratio: 0.01

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 335

Type safetyok

check:low_escape_density: no
check:strict_config: no
escapes: 229
escapes_per_kloc: 7.68

Security

47 poor

Security posture is poor: 89 known vulnerabilities in 34 dependencies; 7 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: ci actions.

How the score is built

Secrets88
Static analysis (SAST)69
Vulnerable dependencies3
CI workflows0
Security posture60
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 157
declared: 157
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 2
secrets_nonprod: 2

Static analysis (opengrep)ok

findings: 123
findings_high: 7
findings_low: 5
findings_medium: 111
parse_errors: 3
scanned_lines: 32,213
weighted_findings: 34.36

Dependencies (osv-scanner)ok

penalty: 212
vulnerabilities: 89
vulnerable_packages: 34
vulns_critical: 2
vulns_high: 41
vulns_low: 7
vulns_medium: 37
vulns_unknown: 2

CI workflows (zizmor)ok

findings: 57
findings_high: 26
findings_low: 5
findings_medium: 26
penalty: 393
workflows: 4

Security postureok1 item

Dependency updates: .github/dependabot.yml .github/dependabot.yml

check:dependency_updates: yes
check:lockfiles: yes
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 100.0%
unpinned_manifests: 0

Release downloadsok16 items

release v1.0.238 ships tabby-1.0.238-portable-arm64.zip (1246 downloads)
release v1.0.238 ships tabby-1.0.238-setup-arm64.exe (6835 downloads)
release v1.0.238 ships tabby-1.0.238-portable-x64.zip (10987 downloads)
release v1.0.238 ships tabby-1.0.238-setup-x64.exe (71683 downloads)
release v1.0.238 ships tabby-1.0.238-linux-armv7l.AppImage (313 downloads)
links to file hosts or shorteners: t.me/ README.de-DE.md
links to file hosts or shorteners: t.me/ README.es-ES.md
links to file hosts or shorteners: t.me/ README.id-ID.md
links to file hosts or shorteners: t.me/ README.it-IT.md
links to file hosts or shorteners: t.me/ README.ja-JP.md
links to file hosts or shorteners: t.me/ README.ko-KR.md
links to file hosts or shorteners: t.me/ README.md
links to file hosts or shorteners: t.me/ README.pl-PL.md
links to file hosts or shorteners: t.me/ README.pt-BR.md
links to file hosts or shorteners: t.me/ README.ru-RU.md
links to file hosts or shorteners: t.me/ README.zh-CN.md

binary_assets: 198
signals: 2
suspicious: 0

Findings

2 critical74 high214 medium99 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-76p3-8jx3-jpfq`	yarn.lock	[email protected] (npm) is affected by GHSA-76p3-8jx3-jpfq	Dependencies (osv-scanner)
critical	`osv/GHSA-pqg4-j6r4-53mv`	yarn.lock	[email protected] (npm) is affected by GHSA-pqg4-j6r4-53mv	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:126	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:132	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:14	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:170	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:175	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:195	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:269	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:275	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:281	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:287	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:293	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:299	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:327	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:389	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:540	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:546	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:58	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:63	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:9	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/codeql-analysis.yml:41	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/codeql-analysis.yml:45	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/codeql-analysis.yml:56	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/codeql-analysis.yml:70	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/docs.yml:10	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/docs.yml:15	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:15	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-2883-xcg3-v3hh`	app/yarn.lock	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	Dependencies (osv-scanner)
high	`osv/GHSA-2m5v-pch6-74hx`	app/yarn.lock	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-4w7w-5xrc-9h26`	app/yarn.lock	[email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-52cp-r559-cp3m`	app/yarn.lock	[email protected] (npm) is affected by GHSA-52cp-r559-cp3m	Dependencies (osv-scanner)
high	`osv/GHSA-5p4m-2wfm-xmqj`	app/yarn.lock	[email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	app/yarn.lock	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-9jxc-qjr9-vjxq`	app/yarn.lock	[email protected] (npm) is affected by GHSA-9jxc-qjr9-vjxq	Dependencies (osv-scanner)
high	`osv/GHSA-p2f4-r6v6-j797`	app/yarn.lock	[email protected] (npm) is affected by GHSA-p2f4-r6v6-j797	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	app/yarn.lock	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	app/yarn.lock	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-w5hq-g745-h8pq`	app/yarn.lock	[email protected] (npm) is affected by GHSA-w5hq-g745-h8pq; also in tabby-electron/yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-xjj6-f33q-929c`	app/yarn.lock	[email protected] (npm) is affected by GHSA-xjj6-f33q-929c; also in yarn.lock	Dependencies (osv-scanner)
high	`opengrep/javascript.lang.security.detect-child-process`	scripts/build-windows.mjs:41	Detected calls to child_process from a function argument `configuration`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	tabby-core/src/directives/dropZone.directive.ts:23	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	tabby-core/src/directives/dropZone.directive.ts:23	User controlled data in a `this.dropHint.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	tabby-core/src/directives/fastHtmlBind.directive.ts:22	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	tabby-core/src/directives/fastHtmlBind.directive.ts:22	User controlled data in a `this.el.nativeElement.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	tabby-core/src/services/themes.service.ts:226	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	tabby-core/src/services/themes.service.ts:226	User controlled data in a `document.querySelector('style#custom-css')!.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`osv/GHSA-w5hq-g745-h8pq`	tabby-core/yarn.lock	[email protected] (npm) is affected by GHSA-w5hq-g745-h8pq	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	tabby-ssh/yarn.lock	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in tabby-terminal/yarn.lock; also in web/yarn.lock; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	tabby-ssh/yarn.lock	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in tabby-terminal/yarn.lock; also in web/yarn.lock; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-ph9p-34f9-6g65`	tabby-terminal/yarn.lock	[email protected] (npm) is affected by GHSA-ph9p-34f9-6g65; also in web/yarn.lock; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-23c5-xmqv-rm74`	yarn.lock	[email protected] (npm) is affected by GHSA-23c5-xmqv-rm74	Dependencies (osv-scanner)
high	`osv/GHSA-2m5v-pch6-74hx`	yarn.lock	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	Dependencies (osv-scanner)
high	`osv/GHSA-39pv-4j6c-2g6v`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-39pv-4j6c-2g6v	Dependencies (osv-scanner)
high	`osv/GHSA-3ppc-4f35-3m26`	yarn.lock	[email protected] (npm) is affected by GHSA-3ppc-4f35-3m26	Dependencies (osv-scanner)
high	`osv/GHSA-48r7-hpm6-gfxm`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-48r7-hpm6-gfxm	Dependencies (osv-scanner)
high	`osv/GHSA-4w7w-5xrc-9h26`	yarn.lock	[email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26	Dependencies (osv-scanner)
high	`osv/GHSA-58c5-g7wp-6w37`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-58c5-g7wp-6w37	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	yarn.lock	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	yarn.lock	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-7r86-cg39-jmmj`	yarn.lock	[email protected] (npm) is affected by GHSA-7r86-cg39-jmmj	Dependencies (osv-scanner)
high	`osv/GHSA-9c47-m6qq-7p4h`	yarn.lock	[email protected] (npm) is affected by GHSA-9c47-m6qq-7p4h	Dependencies (osv-scanner)
high	`osv/GHSA-jhpw-976m-542j`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jhpw-976m-542j	Dependencies (osv-scanner)
high	`osv/GHSA-jj27-h5hq-8x99`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99	Dependencies (osv-scanner)
high	`osv/GHSA-jj27-h5hq-8x99`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99	Dependencies (osv-scanner)
high	`osv/GHSA-jr5w-w6x2-84p9`	yarn.lock	[email protected] (npm) is affected by GHSA-jr5w-w6x2-84p9	Dependencies (osv-scanner)
high	`osv/GHSA-jrmj-c5cx-3cw6`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jrmj-c5cx-3cw6	Dependencies (osv-scanner)
high	`osv/GHSA-jrmj-c5cx-3cw6`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jrmj-c5cx-3cw6	Dependencies (osv-scanner)
high	`osv/GHSA-p3vc-36g9-x9gr`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-p3vc-36g9-x9gr	Dependencies (osv-scanner)
high	`osv/GHSA-prjf-86w9-mfqv`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-prjf-86w9-mfqv	Dependencies (osv-scanner)
high	`osv/GHSA-q6f4-qqrg-jv6x`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-q6f4-qqrg-jv6x	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	yarn.lock	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	yarn.lock	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	Dependencies (osv-scanner)
high	`osv/GHSA-rgjc-h3x7-9mwg`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-rgjc-h3x7-9mwg	Dependencies (osv-scanner)
high	`osv/GHSA-v4hv-rgfq-gp49`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-v4hv-rgfq-gp49	Dependencies (osv-scanner)
high	`osv/GHSA-xjj6-f33q-929c`	yarn.lock	[email protected] (npm) is affected by GHSA-xjj6-f33q-929c	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	app/lib/cli.ts:109	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/commands.ts:34	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/commands.ts:35	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/commands.ts:42	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/directives/dropZone.directive.ts:23	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/services/locale.service.ts:216	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-core/src/services/locale.service.ts:244	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	tabby-core/src/services/profiles.service.ts:213	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-core/src/utils.ts:24	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-electron/src/index.ts:162	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-electron/src/index.ts:163	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-electron/src/index.ts:164	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-electron/src/index.ts:165	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/services/electron.service.ts:30	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/services/log.service.ts:11	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/services/platform.service.ts:84	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/cmder.ts:34	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/cmder.ts:53	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/cygwin32.ts:38	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/cygwin64.ts:38	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/gitBash.ts:45	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/msys2.ts:43	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/powershellCore.ts:47	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/windowsStock.ts:52	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/windowsStock.ts:60	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-electron/src/shells/windowsStock.ts:75	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-local/src/buttonProvider.ts:19	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-settings/src/buttonProvider.ts:27	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-ssh/src/session/ssh.ts:962	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-terminal/src/api/baseTerminalTab.component.ts:361	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-terminal/src/api/baseTerminalTab.component.ts:548	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-terminal/src/api/baseTerminalTab.component.ts:550	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	tabby-terminal/src/middleware/streamProcessing.ts:71	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-debugger`	tabby-web-demo/data/v86_all.js:553	found debugger call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-debugger`	tabby-web-demo/data/v86_all.js:600	found debugger call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-prompt`	tabby-web-demo/data/v86_all.js:637	found prompt() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-web-demo/data/v86_all.js:712	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	tabby-web-demo/src/buttonProvider.ts:21	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:15	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:21	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:27	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:3	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:33	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:39	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:45	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:51	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:57	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:63	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:69	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:9	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:138	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/build.yml:169	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:306	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/build.yml:326	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:4	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:40	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/build.yml:57	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/build.yml:8	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/codeql-analysis.yml:40	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/docs.yml:4	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/docs.yml:9	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/release.yml:10	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/archived-uses`	.github/workflows/release.yml:15	action or reusable workflow from archived repository [confidence high]	CI workflows (zizmor)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/src/plugins.ts:163	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/src/plugins.ts:163	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/src/plugins.ts:164	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/src/plugins.ts:73	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/webpack.config.main.mjs:22	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	app/webpack.config.mjs:42	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`osv/GHSA-3g3m-2fjr-6pw4`	app/yarn.lock	[email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4	Dependencies (osv-scanner)
medium	`osv/GHSA-4qv8-2p9j-2685`	app/yarn.lock	[email protected] (npm) is affected by GHSA-4qv8-2p9j-2685; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-55wc-3pg8-jfw6`	app/yarn.lock	[email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	app/yarn.lock	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-f72v-6w45-q472`	app/yarn.lock	[email protected] (npm) is affected by GHSA-f72v-6w45-q472; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	app/yarn.lock	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-h3mg-xc3c-68pw`	app/yarn.lock	[email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw	Dependencies (osv-scanner)
medium	`osv/GHSA-h67p-54hq-rp68`	app/yarn.lock	[email protected] (npm) is affected by GHSA-h67p-54hq-rp68	Dependencies (osv-scanner)
medium	`osv/GHSA-j6r3-76f7-8jcv`	app/yarn.lock	[email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv	Dependencies (osv-scanner)
medium	`osv/GHSA-mh29-5h37-fv8m`	app/yarn.lock	[email protected] (npm) is affected by GHSA-mh29-5h37-fv8m	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	app/yarn.lock	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rxp7-6hxx-x8q5`	app/yarn.lock	[email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5	Dependencies (osv-scanner)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/appRoot.component.pug:70	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/appRoot.component.pug:97	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/typescript.angular.security.audit.angular-bypasssecuritytrust`	tabby-core/src/components/startPage.component.ts:28	Detected the use of `bypassSecurityTrustHtml`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `bypassSecurityTrustHtml`, ensure it does not come from user-input...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/tabHeader.component.pug:1	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/tabHeader.component.pug:2	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/tabHeader.component.pug:28	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/transfersMenu.component.pug:19	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/transfersMenu.component.pug:23	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/transfersMenu.component.pug:3	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/transfersMenu.component.pug:5	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-core/src/components/transfersMenu.component.pug:6	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-require`	tabby-core/src/services/locale.service.ts:244	Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-core/src/services/log.service.ts:29	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`osv/GHSA-gcqx-w48m-w2h4`	tabby-core/yarn.lock	[email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4; also in web/yarn.lock	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/colorSchemes.ts:20	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/log.service.ts:13	Detected that function argument `electron` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/log.service.ts:14	Detected that function argument `electron` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/log.service.ts:21	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-electron/src/services/log.service.ts:39	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:29	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:30	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:30	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/platform.service.ts:332	Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/platform.service.ts:499	Detected that function argument `relativePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/platform.service.ts:504	Detected that function argument `relativePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/services/platform.service.ts:65	Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:68	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:68	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:70	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/services/platform.service.ts:70	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/sftpContextMenu.ts:51	Detected that function argument `item` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/sftpContextMenu.ts:55	Detected that function argument `item` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/shells/windowsBase.ts:45	Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/shells/windowsBase.ts:50	Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/sshImporters.ts:101	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/sshImporters.ts:127	Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/sshImporters.ts:128	Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-electron/src/sshImporters.ts:145	Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/sshImporters.ts:279	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/sshImporters.ts:386	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/sshImporters.ts:446	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-electron/src/sshImporters.ts:99	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-linkifier/src/handlers.ts:61	Detected that function argument `uri` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-linkifier/src/handlers.ts:73	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-linkifier/src/handlers.ts:73	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-local/src/cli.ts:25	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-local/src/cli.ts:25	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-local/src/cli.ts:90	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-local/src/cli.ts:90	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-local/src/util.ts:28	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-plugin-manager/src/components/pluginsSettingsTab.component.pug:113	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-plugin-manager/src/components/pluginsSettingsTab.component.pug:42	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-plugin-manager/src/components/pluginsSettingsTab.component.pug:86	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	tabby-settings/src/components/hotkeySettingsTab.component.ts:40	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	tabby-settings/src/components/hotkeySettingsTab.component.ts:55	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-settings/src/components/windowSettingsTab.component.pug:201	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-settings/src/components/windowSettingsTab.component.pug:229	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-settings/src/components/windowSettingsTab.component.pug:238	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-settings/src/components/windowSettingsTab.component.pug:251	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-settings/src/components/windowSettingsTab.component.pug:264	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-ssh/src/components/sftpPanel.component.pug:40	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-ssh/src/components/sftpPanel.component.ts:165	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-ssh/src/components/sftpPanel.component.ts:184	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	tabby-ssh/src/components/sftpPanel.component.ts:241	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`osv/GHSA-6cpc-mj5c-m9rq`	tabby-ssh/yarn.lock	[email protected] (npm) is affected by GHSA-6cpc-mj5c-m9rq	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	tabby-ssh/yarn.lock	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in tabby-terminal/yarn.lock; also in web/yarn.lock; also in yarn.lock	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	tabby-terminal/src/components/appearanceSettingsTab.component.ts:30	RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-terminal/src/components/colorSchemeSelector.component.pug:2	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.express.security.audit.xss.pug.template-explicit-unescape`	tabby-terminal/src/components/terminalSettingsTab.component.pug:221	Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:167	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:168	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:168	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:168	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:168	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	tabby-web-demo/data/v86_all.js:169	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:189	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:190	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	tabby-web-demo/data/v86_all.js:4	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	tabby-web-demo/data/v86_all.js:5	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:60	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:60	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:60	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:60	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	tabby-web-demo/data/v86_all.js:60	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.insufficient-postmessage-origin-validation`	tabby-web-demo/data/v86_all.js:70	No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.wildcard-postmessage-configuration`	tabby-web-demo/data/v86_all.js:70	The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-web-demo/data/v86_all.js:712	Detected that function argument `g` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-web-demo/data/v86_all.js:712	Detected that function argument `r` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-web-demo/data/v86_all.js:712	Detected that function argument `r` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tabby-web-demo/data/v86_all.js:712	Detected that function argument `g` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.wildcard-postmessage-configuration`	web/entry.ts:26	The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	web/webpack.config.mjs:46	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`osv/GHSA-477h-4r7f-fvrx`	web/yarn.lock	[email protected] (npm) is affected by GHSA-477h-4r7f-fvrx	Dependencies (osv-scanner)
medium	`osv/GHSA-6pq8-jhm2-2vcw`	web/yarn.lock	[email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw	Dependencies (osv-scanner)
medium	`osv/GHSA-848j-6mx2-7j84`	web/yarn.lock	[email protected] (npm) is affected by GHSA-848j-6mx2-7j84	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	webpack.plugin.config.mjs:175	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	webpack.plugin.config.mjs:46	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	webpack.plugin.config.mjs:58	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	webpack.plugin.config.mjs:62	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	webpack.plugin.config.mjs:62	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`osv/GHSA-4qv8-2p9j-2685`	yarn.lock	[email protected] (npm) is affected by GHSA-4qv8-2p9j-2685	Dependencies (osv-scanner)
medium	`osv/GHSA-55wc-3pg8-jfw6`	yarn.lock	[email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6	Dependencies (osv-scanner)
medium	`osv/GHSA-58w9-8g37-x9v5`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-58w9-8g37-x9v5	Dependencies (osv-scanner)
medium	`osv/GHSA-593m-55hh-j8gv`	yarn.lock	@sentry/[email protected] (npm) is affected by GHSA-593m-55hh-j8gv	Dependencies (osv-scanner)
medium	`osv/GHSA-692r-grfm-v8x7`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-692r-grfm-v8x7	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	yarn.lock	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6	Dependencies (osv-scanner)
medium	`osv/GHSA-f3m7-gqxr-g87x`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-f3m7-gqxr-g87x	Dependencies (osv-scanner)
medium	`osv/GHSA-f3m7-gqxr-g87x`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-f3m7-gqxr-g87x	Dependencies (osv-scanner)
medium	`osv/GHSA-f72v-6w45-q472`	yarn.lock	[email protected] (npm) is affected by GHSA-f72v-6w45-q472	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	yarn.lock	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	yarn.lock	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-hh8m-fm6v-7cvg`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-hh8m-fm6v-7cvg	Dependencies (osv-scanner)
medium	`osv/GHSA-hh8m-fm6v-7cvg`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-hh8m-fm6v-7cvg	Dependencies (osv-scanner)
medium	`osv/GHSA-hrr3-gc8f-f4qj`	yarn.lock	[email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj	Dependencies (osv-scanner)
medium	`osv/GHSA-jfgx-762w-99vr`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-jfgx-762w-99vr	Dependencies (osv-scanner)
medium	`osv/GHSA-p297-fm68-3q8c`	yarn.lock	@angular/[email protected] (npm) is affected by GHSA-p297-fm68-3q8c	Dependencies (osv-scanner)
medium	`osv/GHSA-pxg6-pf52-xh8x`	yarn.lock	[email protected] (npm) is affected by GHSA-pxg6-pf52-xh8x	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	yarn.lock	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-w74x-v6f9-j3xg`	yarn.lock	[email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg	Dependencies (osv-scanner)
medium	`osv/GHSA-wjr9-j795-jxcr`	yarn.lock	[email protected] (npm) is affected by GHSA-wjr9-j795-jxcr	Dependencies (osv-scanner)
medium	`osv/GHSA-x562-297c-g43g`	yarn.lock	[email protected] (npm) is affected by GHSA-x562-297c-g43g	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/i18n-extract.mjs:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/i18n-extract.mjs:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/test-hooks.mjs:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/test-hooks.mjs:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-core/src/components/checkbox.component.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-core/src/components/checkbox.component.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-core/src/components/splitTabPaneLabel.component.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-core/src/components/splitTabPaneLabel.component.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-local/src/cli.ts:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-local/src/cli.ts:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-settings/src/components/settingsTabBody.component.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-settings/src/components/settingsTabBody.component.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-terminal/src/cli.ts:31	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-terminal/src/cli.ts:31	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-terminal/src/components/colorSchemeSelector.component.ts:14	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tabby-terminal/src/components/colorSchemeSelector.component.ts:14	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:120	`this.data_end` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:219	`this.counter_reload[a]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:263	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:291	`this.svga_width` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:291	`this.svga_height` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:38	`d` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:40	`d[0]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:439	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:463	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:464	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:470	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:492	`this.irq` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:492	`this.irq` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:492	`this.irq` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:493	`this.dma_channel_8bit` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:493	`this.dma_channel_8bit` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:493	`this.dma_channel_16bit` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:493	`this.dma_channel_16bit` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:524	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:550	`d` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:601	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:601	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:632	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:653	`e` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:653	`g` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:655	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:718	`v` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:737	`this.serial_adapter` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:758	`d` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:787	`c.mode` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	tabby-web-demo/data/v86_all.js:834	`c[d++]` is assigned twice; the first assignment is useless	Lint
low	`zizmor/adhoc-packages`	.github/workflows/build.yml:21	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`zizmor/adhoc-packages`	.github/workflows/build.yml:226	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`zizmor/adhoc-packages`	.github/workflows/build.yml:397	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`zizmor/adhoc-packages`	.github/workflows/build.yml:438	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`zizmor/adhoc-packages`	.github/workflows/build.yml:490	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`gitleaks/aws-access-token`	README.md:158	Possible aws-access-token secret in history (commit fa4c544c9c); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/jwt`	README.md:158	Possible jwt secret in history (commit fa4c544c9c); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	app/lib/urlHandler.ts:56	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	app/src/plugins.ts:262	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`gitleaks/generic-api-key`	dist/app.bundle.js:19	Possible generic-api-key secret in history (commit f35fc846ec); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	package.json:82	Possible generic-api-key secret in history (commit 5a9b4e56b7); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`osv/GHSA-xfqm-j7pc-xrfc`	tabby-core/yarn.lock	[email protected] (npm) is affected by GHSA-xfqm-j7pc-xrfc	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	tabby-electron/src/sshImporters.ts:130	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	tabby-ssh/src/services/passwordStorage.service.ts:54	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`osv/GHSA-52f5-9888-hmc6`	tabby-terminal/yarn.lock	[email protected] (npm) is affected by GHSA-52f5-9888-hmc6; also in web/yarn.lock; also in yarn.lock	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	tabby-web-demo/data/v86_all.js:711	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`osv/GHSA-333x-w4r6-6crp`	yarn.lock	[email protected] (npm) is affected by GHSA-333x-w4r6-6crp	Dependencies (osv-scanner)
low	`osv/GHSA-3qxv-5xgr-q7w9`	yarn.lock	[email protected] (npm) is affected by GHSA-3qxv-5xgr-q7w9	Dependencies (osv-scanner)
low	`osv/GHSA-4x5r-pxfx-6jf8`	yarn.lock	@babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8	Dependencies (osv-scanner)
low	`osv/GHSA-h3v5-h239-pg29`	yarn.lock	[email protected] (npm) is affected by GHSA-h3v5-h239-pg29	Dependencies (osv-scanner)
low	`osv/GHSA-xhq7-xmqj-769h`	yarn.lock	[email protected] (npm) is affected by GHSA-xhq7-xmqj-769h	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	116
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	57
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	89
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	123
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	4

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`467ce8ebfa46`	`prov-5+qual-2+sec-2`	0%	59	47

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Eugeny/tabby/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Eugeny/tabby/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Eugeny/tabby/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Eugeny/tabby/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Eugeny/tabby/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Eugeny/tabby/)

Full text report

Repository: https://github.com/Eugeny/tabby
Commit: 467ce8ebfa467fb88cf6d154c9a5891e3d3647f0
Generated: 2026-11-14T15:32:50+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	explicit	95%	100%
Code quality	59	weak	90%	100%
Security	47	poor	85%	100%

AI provenance

Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.

Explicitly attributed share (lower bound): 0.5%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.5%

AI tool	Attributed commits	Lines added
Claude Code	7	181
GitHub Copilot coding agent	6	167
Cursor agent	1	18

Current source lines last changed by AI-attributed commits: 343 of 32,218.

Too few lines in one group to compare finding densities.

Stylometry index: 0.02 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-09	2	0%
2025-10	91	18%
2025-11	103	0%
2025-12	21	0%
2026-01	345	16%
2026-02	298	0%
2026-04	219	50%
2026-05	761	0%
2026-06	1,245	0%
2026-07	385	0%
2026-09	1,561	10%
2026-10	394	7%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (a78fff991b89)
Claude Code: trailer 'Co-authored-by: Claude' (49ae72ad24c8)
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (2af22b99de3b)
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (cdae0b6ea2b6)
Claude Code: trailer 'Co-authored-by: Claude' (7e26a579bc42)
Claude Code: trailer 'Co-authored-by: Claude' (9cd1697f6f6e)
Cursor agent: trailer 'Co-authored-by: Cursor Agent' (ea8013003b3c)
Claude Code: trailer 'Co-authored-by: Claude' (8d89013e340d)
GitHub Copilot coding agent: author Copilot (b82ac4c9add2)
GitHub Copilot coding agent: trailer 'Co-authored-by: copilot' (d8fdecda8169)
Claude Code: trailer 'Co-authored-by: Claude' (5e1bdbf28d52)
Claude Code: trailer 'Co-Authored-By: Claude' (02216ff4e7a0)
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (431ea2156337)
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (bbcb02643317)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.01, no CI test run detected; 10% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	75
Duplication	84
Code smells (Opengrep)	64
Tests and CI	37
Documentation	65
Type safety	0
Process (Scorecard review/maintenance)	n/a

Functions: 4,308; mean complexity 2.3, 90th percentile 4; 46 complex and 4 long functions
Duplicated lines: 2.9% of 20,773 compared
Tests: 379 test lines for 32,218 source lines (ratio 0.01); CI test commands: none detected; 5% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is poor: 89 known vulnerabilities in 34 dependencies; 7 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	88
Static analysis (Opengrep)	69
Vulnerable dependencies (OSV)	3
CI workflows (zizmor)	0
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	n/a

Known vulnerabilities: 89 in 34 packages (critical 2, high 41, medium 37, low 7)
Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy

Top findings

Severity	Finding	Location
critical	`osv/GHSA-76p3-8jx3-jpfq`: [email protected] (npm) is affected by GHSA-76p3-8jx3-jpfq	yarn.lock
critical	`osv/GHSA-pqg4-j6r4-53mv`: [email protected] (npm) is affected by GHSA-pqg4-j6r4-53mv	yarn.lock
high	`opengrep/javascript.lang.security.detect-child-process`: Detected calls to child_process from a function argument `configuration`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]	scripts/build-windows.mjs:41
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/directives/dropZone.directive.ts:23
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.dropHint.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/directives/dropZone.directive.ts:23
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/directives/fastHtmlBind.directive.ts:22
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.el.nativeElement.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/directives/fastHtmlBind.directive.ts:22
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/services/themes.service.ts:226
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.querySelector('style#custom-css')!.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	tabby-core/src/services/themes.service.ts:226
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-p2f4-r6v6-j797`: [email protected] (npm) is affected by GHSA-p2f4-r6v6-j797	app/yarn.lock
high	`osv/GHSA-9jxc-qjr9-vjxq`: [email protected] (npm) is affected by GHSA-9jxc-qjr9-vjxq	app/yarn.lock
high	`osv/GHSA-2883-xcg3-v3hh`: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	app/yarn.lock
high	`osv/GHSA-52cp-r559-cp3m`: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m	app/yarn.lock
high	`osv/GHSA-5p4m-2wfm-xmqj`: [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj	app/yarn.lock
high	`osv/GHSA-2m5v-pch6-74hx`: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-4w7w-5xrc-9h26`: [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-qrxm-fqhp-jwvm`: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-xjj6-f33q-929c`: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c; also in yarn.lock	app/yarn.lock
high	`osv/GHSA-w5hq-g745-h8pq`: [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq; also in tabby-electron/yarn.lock	app/yarn.lock
high	`osv/GHSA-w5hq-g745-h8pq`: [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq	tabby-core/yarn.lock
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in tabby-terminal/yarn.lock; also in web/yarn.lock; also in yarn.lock	tabby-ssh/yarn.lock
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in tabby-terminal/yarn.lock; also in web/yarn.lock; also in yarn.lock	tabby-ssh/yarn.lock
high	`osv/GHSA-ph9p-34f9-6g65`: [email protected] (npm) is affected by GHSA-ph9p-34f9-6g65; also in web/yarn.lock; also in yarn.lock	tabby-terminal/yarn.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v1.0.238 ships tabby-1.0.238-portable-arm64.zip (1246 downloads)
binary-release-asset: release v1.0.238 ships tabby-1.0.238-setup-arm64.exe (6835 downloads)
binary-release-asset: release v1.0.238 ships tabby-1.0.238-portable-x64.zip (10987 downloads)
binary-release-asset: release v1.0.238 ships tabby-1.0.238-setup-x64.exe (71683 downloads)
binary-release-asset: release v1.0.238 ships tabby-1.0.238-linux-armv7l.AppImage (313 downloads)
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/
readme-download-lure: links to file hosts or shorteners: t.me/

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 32,218; test lines: 379

Language	Lines
TypeScript	30,196
JavaScript	2,018
C++	378
Lua	5